CVE-2020-11064 - Cross-Site Scripting in TYPO3 CMS

Back Back to CVE browser

MEDIUM

Cross-Site Scripting in TYPO3 CMS

Published May 13, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.54%

Description

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

Affected products

Vendor TYPO3 Product Typo3 Cms Default
n/a
- Version
  >= 10.0.0, < 10.4.2
  Status
  affected
  Constraints
  -
- Version
  >= 9.0.0, < 9.5.17
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TYPO3

Typo3 Cms

n/a

Version	Status	Constraints
>= 10.0.0, < 10.4.2	affected	-
>= 9.0.0, < 9.5.17	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (7)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0407		Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11064.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11064.yaml
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-43gj-mj2w-wh46		x_refsource_CONFIRMThird Party Advisory
https://github.com/advisories/GHSA-43gj-mj2w-wh46		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-11064
https://typo3.org/security/advisory/typo3-core-sa-2020-002